Credit Union Information Security Podcast

Big brother isn't the relation the government sees itself portraying in developing the National Strategy for Trusted Identities in Cyberspace. Uncle Sam has a more avuncular role in mind, giving advice and serving as a role model.

Kevin Sullivan spent months at Ground Zero after the 9/11 attacks on the World Trade Center. Now, post-Bin Laden, Sullivan says the 9/11 experience changed him both personally and professionally, and impacted how banking institutions view money laundering and BSA violations.

"On a global basis, countries are recognizing that they need a uniform commercial code, if you will, for data - a unified approach for managing IT infrastructure services," says Marlin Pohlman of the Cloud Security Alliance.

Intel CISO Malcolm Harkins says the Sony PlayStation breach reminds CISOs in all sectors that such incidents can't be avoided, but their risks can be managed.

A review of the month's top stories by Managing Editor Tracy Kitten: A well-crafted e-mail tricked an RSA employee into opening a phishy e-mail that launched a sophisticated attack on the company's information systems, and the list of big-name corporations and brands affected by the Epsilon e-mail breach tops 100.

Four years ago, the Council of Registered Ethical Security Testers began as an organization to bring standardization to the penetration testing industry. Today, CREST's scope is expanding across industries and global regions, says president Ian Glover.

IT security and privacy lawyer David Navetta says revelations that mobile devices such as the iPhone, iPad and Android maintain hidden files tracking users locations could pose a threat to organizations, regardless of whether the devices are owned by individual employees, the company or government agency for which they work.

FICO's Mike Urban says more questions than answers surround the Durbin amendment's future impact on fraud prevention. But bankers and the Fed may get a two-year reprieve to evaluate the legislation, if a new bill now before the Senate passes.

Gigi Hyland of the NCUA says the latest draft of online authentication guidance is awaiting final signoff from just one FFIEC member agency. And Verizon's new data breach report finds that compromised records resulting from data breaches dropped dramatically in 2010, but the number of breaches continues to grow.

From mobile devices to social media and cloud computing, IT governance is all about risk management. "You can't de-risk everything, but you can de-risk the majority of circumstances you will see in normal operations," says governance expert Robert Stroud.